redis-parser through 3.0.0 Denial of Service via Invalid Array Length
Priority MEDIUM 44CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-08
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Red Hat 2 advisories
- RHSA-2026:92584 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:92578 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92584 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92578 |
Not affected: 2 products
- Red Hat Developer Hub 1
- Self-service automation portal 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-97057
- 2026-10-03 Alias added: GHSA-xwx3-3p4h-ffw8
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92578 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:92584 · Red Hat
References
Other 6
- GitHub Issue #65
- https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L212
- https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L108-L122
- https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L492-L550
- https://github.com/NodeRedis/node-redis-parser/issues/47
- https://github.com/NodeRedis/node-redis-parser
More NodeRedis vulnerabilities
- TI-2026-62976 redis-parser through 3.0.0 Denial of Service via Unbounded Recursion CVSS 4.0HIGH 8.7
Sources
- CVE-2026-97057 · CVE Program
- CVE-2026-97057 · NVD
- FIRST EPSS
- GHSA-xwx3-3p4h-ffw8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-97057 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences